A Company’s Guide to Getting a SOC 1 Type 2 Report
If your company provides services to other organizations—especially services that could have an impact on your customers’ financial reporting—you may need a System and Organization Controls (SOC) 1® Type 2 report.
Below, we address some of the most common questions organizations have about the SOC 1 Type 2 report.
What is a SOC 1 Type 2 Report?
There are two types of SOC 1 reports, simply called a SOC 1 Type 1 and a SOC 1 Type 2. Both types of SOC 1 reports include an examination of an organization’s claims and descriptions of their internal systems and controls.
In a SOC 1 Type 1 report, an auditor reviews the organization’s system description to ensure that it is fairly presented and that the controls are suitably designed as of a specified date. A SOC 1 Type 2 report does all of this as well, but it also goes further to include the actual testing of those controls to determine they are operating effectively for a period of time (usually six to twelve months).
What is tested in a SOC 1 Type 2 report?
A SOC 1 Type 2 report extends the Type 1 report by including testing of your controls. Testing is done on the controls surrounding your organization’s processes and procedures specifically related to the services that your organization provides.
A SOC 1 Type 2 report has no specific criteria. However, the service organization must define what control objectives are relevant to the service they provide and identify the controls they have implemented to meet each control objective.
The testing and results are conformed to your organization’s controls and specific needs. Therefore, testing may look different depending on the organization, the services you provided and the internal controls you have implemented.
How long are internal controls tested for a SOC 1 Type 2 report?
To gain a thorough understanding of how effective your organization’s controls are, those controls must be tested over a period of time.
Various factors—like the number of controls being tested, the size of your business and the impact your organization could have on the financial reporting of your customers—can impact the timeframe of testing and dictate what an appropriate time period would be.
Also, the time period of the SOC exam should overlap with a substantial portion of the period covered by the customer’s financial statements being audited in order for their auditors to rely on testing of the controls.
Generally, SOC 1 Type 2 testing could take anywhere from six to twelve months.
What is the process like for a SOC 1 Type 2 report?
The process for a SOC 1 Type 2 report begins like a Type 1 report, with your organization defining your system and providing your independent, third-party CPA auditor with descriptions of your controls. The SOC auditor will then review those controls.
Then, the SOC auditor will define tests for those controls. The controls are then tested over the specified period by your SOC auditor. Once the auditor has completed testing, a report package will be created that includes the auditor’s opinion, which may be unmodified, qualified or adverse.
How do I decide if my organization needs a SOC 1 Type 2 report instead of a Type 1?
There’s a lot that goes into the decision to pursue a SOC 1 Type 2 report. One factor may be that you have a customer that has requested the more extensive report.
Another could be that you want a clear understanding of the effectiveness of your internal controls and reasonable assurance that they are working well. Because the SOC 1 Type 2 report adds clarity about how effective your controls are in real-life scenarios, it can help you find areas for improvement within your own system and controls.
This would allow your organization to tighten up your controls or fix any issues long before a problem or incident occurs.
What are the benefits of a SOC 1 Type 2, and how would a company use the report?
SOC 1 Type 2 reports allow an organization to have a clear idea of the effectiveness of its controls so that it can make any adjustments needed—but that’s just the start.
A SOC 1 Type 2 report sends a very clear message to both your customers and competitors about your commitment to transparency and accuracy. Having a Type 2 report offers an organization a competitive advantage over its competitors that have only completed the Type 1 or don’t have a SOC 1 report at all.
The SOC 1 Type 2 report can be an important vendor management consideration for your customers. If your customers are not already doing their due diligence to ensure that the service organizations or vendors they work with are doing everything they can to protect customers, they will be soon.
Learn More and Get Started with a SOC 1 Type 2 Report
A SOC 1 Type 2 is proof to your customers and potential customers that you take your impact on their financial reports seriously, and that you are taking every step possible to mitigate risks.
Warren Averett has the expertise for a successful SOC report engagement. Contact us today to start the conversations about how we can help your company reach your SOC reporting goals.
